Oracle MySQL: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 33

• Critical 9.8
  CVE-2021-31805 Public exploit Scanner template EPSS 85%

  Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.

  The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluatio…

  Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
  Apr 12, 2022
• Critical 9.8
  CVE-2022-1292 Public exploit EPSS 83%

  The c_rehash script allows command injection

  The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitra…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux
  May 3, 2022
• High 7.5
  CVE-2018-25032 Public exploit EPSS 52%

  Nokogiri affected by zlib's Out-of-bounds Write vulnerability

  zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

  mariadb-10.3 mariadb-10.6 mariadb openjpeg2 Debian Ubuntu Azure Linux Alpine Wolfi RubyGems
  Mar 25, 2022
• High 7.5
  CVE-2021-22119 Public exploit

  Resource Exhaustion in Spring Security

  Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client Web and WebFlux app…

  org.springframework.security:spring-security-core org.springframework.security:spring-security-oauth2-client Maven
  Jun 29, 2021
• High 7.5
  CVE-2022-22968 Public exploit

  Improper handling of case sensitivity in Spring Framework

  In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower ca…

  libspring-java libspring-java org.springframework:spring-context Debian Ubuntu Maven
  Apr 14, 2022
• High 7.5
  CVE-2022-23308

  valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

  qt5-qtwebengine libxml2 libxml2 libxml2 Debian Ubuntu Azure Linux Alpine
  Feb 26, 2022
• Medium 6.5
  CVE-2022-21556

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Jul 19, 2022
• Medium 6.5
  CVE-2022-21569

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Jul 19, 2022
• Medium 6.3
  CVE-2022-21550 EPSS 51%

  Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are a…

  Oracle MySQL Cluster
  Jul 19, 2022
• Medium 5.9
  CVE-2022-21519

  Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are a…

  Oracle MySQL Cluster
  Jul 19, 2022
• Medium 5.8
  CVE-2020-26237

  Prototype Pollution in highlight.js

  Highlight.js is a syntax highlighter written in JavaScript. Highlight.js versions before 9.18.2 and 10.1.2 are vulnerable to Prototype Pollution. A malicious HTML code block can be crafted that will result in prototype pollution of the base object's prototype…

  highlightjs highlight.js highlight.js highlight.js Debian Ubuntu npm
  Nov 24, 2020
• Medium 5.5
  CVE-2022-21509

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Jul 19, 2022
• Medium 5.5
  CVE-2022-21527

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Jul 19, 2022
• Medium 5.5
  CVE-2022-21528

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Jul 19, 2022
• Medium 5.0
  CVE-2022-21539

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Jul 19, 2022
• Medium 4.9
  CVE-2022-21455

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PAM Auth Plugin). Supported versions that…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Jul 19, 2022
• Medium 4.9
  CVE-2022-21515

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are aff…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Jul 19, 2022
• Medium 4.9
  CVE-2022-21517

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Jul 19, 2022
• Medium 4.9
  CVE-2022-21525

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Jul 19, 2022
• Medium 4.9
  CVE-2022-21526

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Jul 19, 2022
• Medium 4.9
  CVE-2022-21529

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Jul 19, 2022
• Medium 4.9
  CVE-2022-21530

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Jul 19, 2022
• Medium 4.9
  CVE-2022-21531

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Jul 19, 2022
• Medium 4.9
  CVE-2022-21534

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions tha…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Jul 19, 2022
• Medium 4.9
  CVE-2022-21537

  Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Jul 19, 2022
• Medium 4.9
  CVE-2022-21547

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Federated). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Jul 19, 2022
• Medium 4.9
  CVE-2022-21553

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Jul 19, 2022
• Medium 4.4
  CVE-2022-21522

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions tha…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Jul 19, 2022
• Medium 4.2
  CVE-2022-21555

  Vulnerability in the MySQL Shell for VS Code product of Oracle MySQL (component: Shell: GUI). Supported versions that a…

  Oracle MySQL Server
  Jul 19, 2022
• Low 3.1
  CVE-2022-21538

  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions…

  Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu
  Jul 19, 2022
• Low 2.5
  CVE-2022-21535

  Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: General/Core Client). Supported versions th…

  Oracle MySQL Server
  Jul 19, 2022
• Unscored —
  CVE-2022-21824 EPSS 22%

  Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be pass…

  Node.js node openjdk11 nodejs Debian Azure Linux Alpine
  Feb 24, 2022
• Unscored —
  CVE-2022-27778

  A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is use…

  curl curl curl Debian Azure Linux Alpine
  Jun 1, 2022

Revision history

1. 2026-05-19 #12

   Neue Updates von Ubuntu aufgenommen

2. 2022-11-30 #11

   Neue Updates von IBM aufgenommen

3. 2022-10-26 #10

   Neue Updates von Oracle Linux aufgenommen

4. 2022-10-25 #9

   Neue Updates von Red Hat aufgenommen

5. 2022-10-19 #8

   Neue Updates von Red Hat aufgenommen

6. 2022-10-18 #7

   Neue Updates aufgenommen

7. 2022-09-21 #6

   Neue Updates von Oracle Linux aufgenommen

8. 2022-09-20 #5

   Neue Updates von Red Hat aufgenommen

9. 2022-09-14 #4

   Neue Updates von Red Hat aufgenommen

10. 2022-08-21 #3

    Neue Updates von NetApp aufgenommen

11. 2022-07-28 #2

    Neue Updates von Ubuntu aufgenommen

12. 2022-07-19 #1

    Initiale Fassung

References

• Menu - Appendix Oracle MySQL vom 2022-07-19
  https://www.oracle.com/security-alerts/cpujul2022.html#AppendixMSQL
• Ubuntu Security Notice USN-5537-1 vom 2022-07-28
  https://ubuntu.com/security/notices/USN-5537-1
• Ubuntu Security Notice USN-5537-2 vom 2022-07-29
  https://ubuntu.com/security/notices/USN-5537-2
• NetApp Security Advisory NTAP-20220729-0004 vom 2022-08-19
  https://security.netapp.com/advisory/ntap-20220729-0004/
• Red Hat Security Advisory RHSA-2022:6518 vom 2022-09-14
  https://access.redhat.com/errata/RHSA-2022:6518
• Red Hat Security Advisory RHSA-2022:6590 vom 2022-09-21
  https://access.redhat.com/errata/RHSA-2022:6590
• Oracle Linux Security Advisory ELSA-2022-6590 vom 2022-09-22
  https://linux.oracle.com/errata/ELSA-2022-6590.html
• Oracle Linux Bulletin-October 2022 vom 2022-10-18
  https://www.oracle.com/security-alerts/linuxbulletinoct2022.html
• Red Hat Security Advisory RHSA-2022:7055 vom 2022-10-19
  https://access.redhat.com/errata/RHSA-2022:7055
• Red Hat Security Advisory RHSA-2022:7119 vom 2022-10-25
  https://access.redhat.com/errata/RHSA-2022:7119
• Oracle Linux Security Advisory ELSA-2022-7119 vom 2022-10-27
  https://linux.oracle.com/errata/ELSA-2022-7119.html
• IBM Security Bulletin 6842821 vom 2022-12-01
  https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-affected-by-multiple-vulnerabilities-in-oracle-mysql/
• Ubuntu Security Notice USN-8276-1 vom 2026-05-19
  https://ubuntu.com/security/notices/USN-8276-1